Website check
coingecko.com
In plain English
coingecko.com scores A (90/100). The biggest issue: no Content Security Policy (plus 1 more).
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
Third-party scripts without integrity checks
The page loads scripts from other companies' servers without a fingerprint check. If one of those servers is hacked, the attacker's code runs on this site.
How to fix: Add integrity and crossorigin attributes to fixed-version third-party scripts, or host the files yourself.
cdn.confiant-integrations.net, eu-us-apac-cdn.consentmanager.net
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
No security.txt file
security.txt tells researchers how to report a security problem to you. Without it, reports may go unsent or to the wrong place.
How to fix: Publish /.well-known/security.txt with at least a Contact: line and an Expires: date (see securitytxt.org).
What the agent did (12 steps)
- 01Picked up a daily rating check
- 02Looking up coingecko.com and connecting over HTTPS
- 03Connected over HTTPS: www.coingecko.com answered 200 after 1 redirect
- 04Certificate from Let's Encrypt, valid 89 more days (TLSv1.3)
- 05Read the security headers: HSTS, X-Frame-Options, nosniff, Referrer-Policy set; missing CSP
- 06No PHP version given away
- 07Found 4 script sources from other sites
- 08Old TLS 1.0/1.1: refused
- 09Plain http:// redirects to HTTPS
- 10No security.txt
- 11Email spoofing protection: SPF set, DMARC set
- 12Scored 90/100, grade A. Writing it up in plain English
Technical details (29)
- ip
- 2606:4700::6812:476
- caa
- 0 issuewild "ssl.com", 0 issuewild "comodoca.com", 0 issuewild "amazon.com", 0 issuewild "pki.goog; cansignhttpexchanges=yes", 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "letsencrypt.org", 0 issue "comodoca.com", 0 issue "sectigo.com", 0 issuewild "digicert.com; cansignhttpexchanges=y...
- tls cipher
- TLS_AES_256_GCM_SHA384
- tls issuer
- Let's Encrypt
- tls subject
- coingecko.com
- tls validTo
- 2027-01-19T13:12:48.000Z
- tls daysLeft
- 89
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 mx include:_spf.google.com include:sendgrid.net include:_spf.getresponse.com include:mail.zendesk.com include:newsletter.coingecko.com -all
- email apex
- coingecko.com
- email dmarc
- v=DMARC1; p=quarantine; pct=100; rua=mailto:hello@coingecko.com,mailto:geckobot@coingecko.com; ruf=mailto:hello@coingecko.com,mailto:geckobot@coingecko.com; sp=quarantine; aspf=r; adkim=r
- status
- 200
- cookies
- headers server
- cloudflare
- headers referrer-policy
- strict-origin-when-cross-origin
- headers x-frame-options
- SAMEORIGIN
- headers x-content-type-options
- nosniff
- headers strict-transport-security
- max-age=31536000; includeSubDomains; preload
- finalUrl
- https://www.coingecko.com/
- requests
- 5
- timingMs
- 1381
- reachable
- true
- oldTlsProbe
- rejected
- securityTxt
- false
- httpRedirect
- redirects to https
- bodyTruncated
- true
- thirdPartyScripts
- 4
- thirdPartyScriptHosts
- accounts.google.com, challenges.cloudflare.com, cdn.confiant-integrations.net, eu-us-apac-cdn.consentmanager.net
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.